Security

Microsoft security updates and public advisory evidence: affected products, fixing updates, exploitation and source coverage.

Security Update Guide CISA KEV

Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

694539 source statements · aliases may refer to the same vulnerability

CVE-2026-112066Published

Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)

cve-program ·

https://packagist.org/: sgalinski/sg-cookie-optin

CVSS 4.0 7.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112065Published

Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)

cve-program ·

https://packagist.org/: sgalinski/sg-cookie-optin

CVSS 4.0 5.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112069Published

Broken Access Control in extension "FAL Protect" (fal_protect)

cve-program ·

https://packagist.org/: causal/fal-protect

CVSS 4.0 6.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-108062Published

Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop

cve-program ·

Vendor product: Eclipse CSI - PIA

CVSS 4.0 6.9Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-97400Published

jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)

cve-program ·

Vendor product: Eclipse OpenJ9

CVSS 4.0 6.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112912Published

filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker

cve-program ·

Vendor product: filelock

CVSS 3.1 2.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-107597Published

jwks_uri from the OIDC discovery document is fetched without checking its origin or scheme

cve-program ·

Vendor product: Eclipse CSI - PIA

CVSS 4.0 5.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-96402Published

USBX PIMA/MTP host class reads past its receive buffer when a device over-reports its object handle count

cve-program ·

Vendor product: USBX

CVSS 4.0 5.2Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-9589Published

Unblu Spark Authorization Bypass in Configuration Cascade Operations

cve-program ·

Vendor product: Unblu Spark

CVSS 4.0 9.3 · CVSS 4.0 8.9Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112769Published

Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass

cve-program ·

Vendor product: parse-server · Vendor product: parse-server

CVSS 4.0 2.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-113619Published

Eclipse ioFog renders request templates before authentication

cve-program ·

Vendor product: Eclipse ioFog

CVSS 3.1 7.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-95111Published

Module queue front-send validates a word count as a byte count

cve-program ·

Vendor product: ThreadX

CVSS 4.0 4.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112787Published

OpenCATS before 0.10.0 Missing Authorization in Reports Module EEO Reports

cve-program ·

Vendor product: OpenCATS

CVSS 4.0 5.3 · CVSS 3.1 4.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-18205Published

XSS in Ticimax Informatics' Ticimax E-Commerce Platform

cve-program ·

Vendor product: Ticimax E-Commerce Platform

CVSS 3.1 6.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-113620Published

Eclipse ioFog operator WebSocket accepts an unverified JWT

cve-program ·

Vendor product: Eclipse ioFog

CVSS 3.1 9.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-92162Published

Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream

cve-program ·

Vendor product: flatpak

CVSS 4.0 7.2Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112048Published

libspatialite through 5.1.0 Uncontrolled Memory Allocation via ParseWkbPolygon Ring Count

cve-program ·

https://www.gaia-gis.it/fossil/libspatialite: libspatialite

CVSS 4.0 6.9 · CVSS 3.1 6.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-113466Published

MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key

cve-program ·

Vendor product: MinIO

CVSS 4.0 6.9 · CVSS 3.1 5.3 · CVSS 3.0 5.3 · CVSS 2.0 5.0Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-91041Published

FileX fault-tolerant log replay writes past the destination sector when mounting a crafted FAT image

cve-program ·

Vendor product: FileX

CVSS 3.1 7.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-96582Published

Out-of-bounds Read via Check-after-use in the USBX HID Report Descriptor Parser

cve-program ·

Vendor product: USBX

CVSS 3.1 4.9Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-91186Published

PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write

cve-program ·

Vendor product: GUIX

CVSS 4.0 8.4Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-96406Published

VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound

cve-program ·

Vendor product: USBX

CVSS 3.1 4.9Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-14933Published

Unblu Spark Cross-Site Scripting in Embedded Co-Browsing

cve-program ·

Vendor product: Unblu Spark

CVSS 4.0 8.6Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-92449Published

Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arena

cve-program ·

Vendor product: GUIX

CVSS 4.0 6.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112906Published

filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

cve-program ·

Vendor product: filelock

CVSS 3.1 4.7Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-107807Published

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, Nginx UI accepts the Node.Secret master credential through the node_secret query parameter in HTTP and WebSocket authentication paths instead of requiring th…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 20 Oct 2026Recorded 25 Oct 2026

CVE-2026-96903Published

Easy Property Listings < 3.5.27 - Subscriber+ Sensitive Data Disclosure via Contact CRM AJAX Handlers

cve-program ·

Vendor product: Easy Property Listings

Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-96902Published

Easy Property Listings < 3.5.28 - Unauthenticated Hidden Listing Details Disclosure via REST API

cve-program ·

Vendor product: Easy Property Listings

Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-92446Published

GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader

cve-program ·

Vendor product: GUIX

CVSS 4.0 6.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-113397Published

DrayTek Vigor2960 IPsec mainfunction.cgi ruequest_certificate command injection

cve-program ·

Vendor product: Vigor2960

CVSS 4.0 5.3 · CVSS 3.1 7.4 · CVSS 3.0 7.4 · CVSS 2.0 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112915Published

filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout

cve-program ·

Vendor product: filelock

CVSS 3.1 5.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-91189Published

GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a heap out-of-bounds write when loading an untrusted font or theme

cve-program ·

Vendor product: GUIX

CVSS 4.0 7.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-91059Published

JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation size

cve-program ·

Vendor product: GUIX

CVSS 4.0 6.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-107808Published

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, POST /api/login checks EnabledOTP but does not require a WebAuthn assertion when EnabledPasskey is true and no TOTP secret is configured. A passkey-only acco…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 20 Oct 2026Recorded 25 Oct 2026

CVE-2026-112944Published

launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

cve-program ·

Vendor product: launch-editor · Vendor product: vite · Vendor product: vite-plus

CVSS 4.0 6.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-92454Published

JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decode

cve-program ·

Vendor product: GUIX

CVSS 3.1 6.1 · CVSS 4.0 6.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-64959Published

Apache Kylin: Missing authentication on certain cache API endpoints

cve-program ·

Vendor product: Apache Kylin

Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-109587Published

Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel

cve-program ·

Vendor product: FreeRTOS-Kernel

CVSS 3.1 8.8 · CVSS 4.0 9.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-107809Published

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, AuthRequired accepts a browser-managed token cookie as an API credential after the front end stores the JWT in that cookie. Because management endpoints do n…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.8Source modified 20 Oct 2026Recorded 25 Oct 2026

CVE-2026-112939Published

filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

cve-program ·

Vendor product: filelock

CVSS 3.1 4.7Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112833Published

WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Cross Site Scripting (XSS) vulnerability

cve-program ·

https://wordpress.org/plugins: seriously-simple-podcasting

CVSS 3.1 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112943Published

launch-editor: escapeCmdArgs() omits % escaping on Windows

cve-program ·

Vendor product: launch-editor · Vendor product: vite · Vendor product: vite-plus

CVSS 4.0 6.3Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112014Published

LobsterAI before 2026.10.16 Hardcoded Password in Provider API Key Export

cve-program ·

Vendor product: LobsterAI

CVSS 4.0 6.8 · CVSS 3.1 5.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112771Published

Craft CMS before 4.18.8 and 5.11.0 Twig Sandbox Allowlist Bypass via Array Filters

cve-program ·

Vendor product: cms · Vendor product: cms

CVSS 4.0 7.1 · CVSS 3.1 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-111723Published

LingGuo-Drama through commit 8a6924a Broken Access Control via /admin/v1/admins API

cve-program ·

Vendor product: LingGuo-Drama

CVSS 4.0 8.7 · CVSS 3.1 8.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112004Published

Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint

cve-program ·

Vendor product: teable

CVSS 4.0 2.3 · CVSS 3.1 3.1Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-112776Published

Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations

cve-program ·

Vendor product: cms

CVSS 4.0 9.3 · CVSS 3.1 9.8Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-107810Published

Nginx UI is a web user interface for the Nginx web server. From 2.0.0 until 2.5.0, internal/backup/restore.go extracts inner archives before applying the restore_nginx and restore_nginx_ui flags and permits symlinks targeting the live Nginx…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 20 Oct 2026Recorded 25 Oct 2026

CVE-2026-112781Published

Grav 2.0.0 before 2.2.2 Information Disclosure via Form config-*@ Directives

cve-program ·

Vendor product: grav

CVSS 4.0 8.7 · CVSS 3.1 6.5Source modified 20 Oct 2026Recorded 23 Oct 2026

CVE-2026-111713Published

tarteaucitron.js before 1.37.0 XSS via getElemAttr Attribute Validation Mismatch

cve-program ·

Vendor product: tarteaucitron.js

CVSS 4.0 5.1 · CVSS 3.1 5.4Source modified 20 Oct 2026Recorded 23 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.